Disabling SMS as a second factor for 2FA
Updated 2 days ago
by
admin
While SMS-based two-factor authentication (2FA) was once a major step forward for account security, it's now widely recognised as an insecure and outdated method for protecting sensitive accounts. Many high-profile breaches have exploited the vulnerabilities of SMS, and cybersecurity experts and government agencies now strongly advise against relying on it for authentication.
SMS is vulnerable to attacks such as SIM swapping or cloning, SMS interception and man-in-the-middle attacks, with several high profile organisations falling victim this year alone.
To disable SMS as a second factor on your Cloud MFA rules, please follow these steps:
- Log in to your Cloud USS dashboard
- Navigate to Security Modules -> MFA -> Rules and edit any rules that reference MFA authentication. Bypass rules will not need to be amended, for example:
- Double click the "MFA" rule(s) one at a time to open the editor. It is recommended to move the SMS/Email tile to the end of the Selected Conditions column using the up and down arrows, so that SMS is used as a last resort
- Click the Save button
- Once you have confirmed that users are no longer receiving SMS messages and that they are authenticating with other methods, such as the Authenticator App, you can safely delete it from your rule.